#!/usr/bin/env bash
set -euo pipefail

# Import SOPS-encrypted talosconfig and kubeconfig from Hetzner Object Storage
# (s3://renner-uno-k8s-secrets/cluster-access/) into local ~/.talos/config and
# ~/.kube/config.
#
# Requires aws-cli + sops on the workstation, and Hetzner Object Storage
# credentials reachable either via env (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)
# or via an aws-cli profile passed in AWS_PROFILE (the "secrets" profile must
# hold the Hetzner Object Storage keypair).

ENDPOINT="https://fsn1.your-objectstorage.com"
BUCKET="renner-uno-k8s-secrets"
PREFIX="cluster-access"
# Overridable, which the unconditional `export AWS_PROFILE="secrets"` was not.
# The default is unchanged and deliberately so: "secrets" resolves to working
# credentials and this script has always used it. Both "secrets" and "hetzner"
# exist in ~/.aws/credentials on the workstation.
#
# The defect is only the assignment. Forcing the value defeated the env-based
# path this file's own header offers, and it also overrode a caller who had
# already selected a profile — which is how a 403 from HeadObject can appear
# while the credentials the caller intended were perfectly good. That error
# reads as a bucket permissions problem and sends you looking in the wrong
# place.
export AWS_PROFILE="${AWS_PROFILE:-secrets}"


command -v aws >/dev/null  || { echo "aws-cli not found"; exit 1; }
command -v sops >/dev/null || { echo "sops not found"; exit 1; }

TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

echo "Fetching access files from $ENDPOINT/$BUCKET/$PREFIX/ ..."
AWS_DEFAULT_REGION=fsn1 aws --endpoint-url "$ENDPOINT" \
  s3 cp "s3://$BUCKET/$PREFIX/talosconfig.sops" "$TMPDIR/talosconfig.sops"
AWS_DEFAULT_REGION=fsn1 aws --endpoint-url "$ENDPOINT" \
  s3 cp "s3://$BUCKET/$PREFIX/kubeconfig.sops"  "$TMPDIR/kubeconfig.sops"

mkdir -p ~/.talos ~/.kube

sops -d --input-type binary --output-type binary "$TMPDIR/talosconfig.sops" > ~/.talos/config
chmod 600 ~/.talos/config

sops -d --input-type binary --output-type binary "$TMPDIR/kubeconfig.sops" > ~/.kube/config
chmod 600 ~/.kube/config

echo "Imported:"
echo "  ~/.talos/config"
echo "  ~/.kube/config"
kubectl get nodes 2>&1 | head -5